Not every hack is based off patching bytes. However, If it is, the off bytes are generally the original bytes in the exe. Go to the address in a hex editor, get the byte at that address, and x bytes after that address that will undo the bytes you patched. To get the bytes for turning it on, you need to learn ASM and understand what the bytes exactly do. In many cases, people generally nop out or 0x90 instructions that will affect either execution or flow.